Sees everything. Touches nothing. Leaves nothing behind.
Switchboard plugs into the systems that run your business — PSA, RMM, client tenants, billing. We built it assuming it will be attacked through the data it reads: a ticket note, a device name, an uploaded PDF. So the engine runs read-only, inside a sandbox that is thrown away after every turn, on a network that reaches only the hosts we name.
Controls
Read-only by construction
The read-only tiers are wired through MCP servers that carry read tools only. There is no write tool to misuse, on any platform.
A throwaway sandbox, every turn
Each turn runs in its own bubblewrap sandbox: a fresh home, only your org's workspace mounted, host secrets masked, environment scrubbed, hard-killed at 40 minutes.
No network of its own
The sandbox has no route to the internet. Its one door is an allow-list proxy that admits Anthropic and our two control planes, and nothing else.
Credentials never reach the browser
Platform tokens live in a server-side vault. Each agent gets its own scoped token; nothing sensitive is ever shipped to a tech's laptop.
Built for prompt injection
Ticket notes, device names, uploads and email are fenced as untrusted before the model sees them. Memory carries provenance, playbook edits are quarantined as suggestions, and a poisoned-document drill ended with a refusal, zero egress and zero writes.
One tenant, one fence
Row-level security on every table, keyed on org membership, and a cross-org probe that tries the access rather than reading the policy.
Posture
What you are letting in
A read-only engine, running each turn in a throwaway sandbox with no network of its own, using credentials it never shows the browser, inside a database where every row is fenced to your org. Everything on this page is live today; each item names what it rests on, and the section at the end says what we do not claim.
Scope
What it can touch
On the trial and read-only tiers the engine holds read-only tokens and is wired through MCP servers that expose read tools only. It can look anything up and change nothing.
On managed, write access exists — and every destructive call parks as a pending action for approval. An owner or admin approves it, and the worker runs exactly one call of one tool on a fresh conversation. Scheduled runs, prompt, title and recipient changes, and every re-enable park the same way. Delivery contacts expire after 90 days.
Mechanics
How a turn runs
A turn is a job. The worker that claims it is handed a token bound to that job for 50 minutes, checked against the live job on every call; the worker signs its own requests with an Ed25519 key registered per host, and a result from a job that is no longer live is rejected.
- Fresh home directory on a sized tmpfs; only this org's workspace, this session's transcript and a private copy of the OAuth file are mounted.
- Host secrets masked; the process sees an environment of five variables.
- Own network namespace: the only way out is a socat forwarder to the allow-list proxy's Unix socket. Anthropic and our two control planes are admitted; everything else is unroutable.
- 40-minute hard kill of the whole process group; a 40-call tool budget per turn.
- Boot self-test proves the masks hold and that no direct route exists; if it fails, the brain claims nothing.
Adversarial input
Prompt injection
The platform ingests text your customers wrote — ticket subjects, notes, device names, uploaded documents — and every one of those channels is fenced as untrusted before it reaches the model: lookups, session excerpts, alerts, research output, memory, prior answers, playbooks, uploads, the MSP profile, artifact titles and health digests.
Memory carries provenance and shows it. Playbook edits the engine proposes are quarantined as suggestions until a person accepts them. Email HTML goes through an allow-list serialiser; HTML and SVG artifacts are stored inert and downloaded as attachments.
Drilled on 2026-09-07 with a document carrying hidden instructions to exfiltrate credentials, email the workspace and add a playbook rule: the engine summarised it, called out the hidden block, refused the second attempt, and the ledgers showed zero egress attempts, zero outbound mail, zero playbook suggestions, zero pending actions and zero memory writes.
Tenancy
One tenant, one fence
Row-level security is enabled on every table in the public schema, keyed on org membership through a single membership helper. Domain-scoped views put PSA data behind service, finance and projects permissions, so a technician without the finance domain never sees an agreement id.
The cross-org probe creates a second org the caller does not belong to, puts data in it, impersonates an ordinary client and tries to read it — inside a transaction that is rolled back. It is re-run after schema changes.
Sign-in
Your account
- Mandatory TOTP two-factor for password users, enforced as an app-level AAL2 gate.
- Microsoft and Google sign-in with PKCE.
- Invite-only signup, enforced by a database trigger — a user created in the dashboard still needs a pending invite.
- One session per user; a new sign-in revokes the others.
- Leaked-password screening against HaveIBeenPwned.
- MFA reset for a locked-out user is a platform-admin action backed by a server-side function, never a client-side switch.
Your data
What we keep, and how you remove it
We cache what the engine needs to answer quickly: the estate map (clients, devices, servers), a PSA mirror (tickets, time, projects), and the health results derived from them. The Data tab lists every dataset per platform with its size and last sync, and purges it on request.
Sessions, artifacts, memory and the job queue live on the shared project under row-level security. A dedicated database moves the caches to your own Supabase project.
Infrastructure
Shared or dedicated. Your call.
Shared is the default and, on read-only, the posture we would choose for ourselves. Dedicated is for the org that needs a contractual answer.
Shared
included · the default on every tier
A pool of identical brain servers and one database, isolated per org by row-level security. On read-only, this is where we would put our own shop: read-only tokens, a fresh sandbox every turn, no other tenant's rows reachable.
Dedicated database
$200/mo · any tier
Your own Supabase project for everything we cache about your environment: tickets, devices, tenants, health. Sign-in, billing and the job queue stay on ours. Self-serve, minutes to provision; at cut-over we resync into the empty project and purge your rows from the shared caches.
Dedicated brain server
$500/mo · any tier · included with managed
Your own brain host. No other org's turn ever runs on it, the egress list is yours, and it comes with managed.
Honesty
What we don't claim
Said plainly, so nobody has to ask twice.
- No SOC 2 report yet.
- No ISO 27001 certification yet.
- No third-party penetration test yet — our own assessment and drills are linked above, and we will list a third party's here when it exists.
Disclosure
Report a problem
Found something? Write to us directly. We answer, we fix, and we say what we fixed.